[Phase 0e] Subscription lifecycle: cancel-subscription + resume-subscription (~3h)

[TortoiseWolfe]

Part of epic #100.

Functions to ship

Both functions branch on subscriptions.provider to dispatch to the right SDK.

1. cancel-subscription (~1.5h)

• Browser caller: src/components/payment/SubscriptionManager/SubscriptionManager.tsx:87
• Request body: { subscription_id: string } (the internal subscriptions table row id, NOT the provider's id)
• Logic:
  1. CORS + auth
  2. Load subscriptions row, verify owner
  3. Branch on provider:
     • Stripe: stripe.subscriptions.cancel(provider_subscription_id) (immediate) or stripe.subscriptions.update(id, { cancel_at_period_end: true }) (graceful)
     • PayPal: POST /v1/billing/subscriptions/{provider_id}/cancel with { reason }
  4. Update local subscriptions.status to cancelled or cancel-at-period-end
  5. Return updated row

2. resume-subscription (~1.5h)

• Browser caller: src/components/payment/SubscriptionManager/SubscriptionManager.tsx:126
• Request body: { subscription_id: string }
• Logic:
  1. Same auth + load
  2. Branch on provider:
     • Stripe: stripe.subscriptions.update(id, { cancel_at_period_end: false }) — only valid if status was cancel-at-period-end
     • PayPal: POST /v1/billing/subscriptions/{provider_id}/activate
  3. Update local subscriptions.status to active
  4. Return updated row

Tests

• Deno unit tests mocking both SDKs
• Un-skip cancel/resume E2E tests under tests/e2e/payment/

Acceptance

• Both functions exist
• Deno tests pass
• Deploy succeeds
• SubscriptionManager Cancel + Resume buttons work for both Stripe and PayPal sandbox subscriptions

🤖 Created from audit on 2026-05-20

[TortoiseWolfe]

Status (2026-06-06): core SHIPPED in #130 — leaving open until acceptance is fully met

The two edge functions this issue calls for are implemented and wired, shipped in PR #130 (dc1170e):

• supabase/functions/cancel-subscription/index.ts (210 lines) — JWT + owner check, Stripe cancel_at_period_end:true / PayPal /cancel, sets status='canceled'.
• supabase/functions/resume-subscription/index.ts (209 lines) — owner check, must-be-canceled guard, Stripe/PayPal reactivate, sets status='active'.
• Browser callers wired in SubscriptionManager.tsx ([Eval-Backlog] SUBSCRIPTION-MGMT: subscription management route + 4 edge functions + grace-period wiring #5 / PR feat(payment): #5 subscription management surface end-to-end #140).

Deliberately NOT closing — two acceptance items remain unmet, and closing would misrepresent the ledger:

1. Deno unit tests for cancel/resume (mock Stripe SDK + PayPal fetch) — no index.test.ts yet for these two. Autonomous follow-up (no creds).
2. E2E un-skip — tests/e2e/payment/02-paypal-subscription.spec.ts cancel/resume flows are test.skip, blocked on a subscription-seeding fixture (+ PayPal sandbox keys for the live path).

Close when (1) lands and (2) is either un-skipped or its blocker (seed fixture + creds) is itself tracked.